The Purchase and Expense Manager WordPress plugin contains a Cross‑Site Request Forgery weakness caused by missing nonce validation in the sup_pt_handle_deletion function. This flaw, identified as CWE‑352, permits an unauthenticated attacker to delete any purchase record when a logged‑in site administrator is tricked into submitting a forged request. The impact is loss of data integrity and trust in financial records, while confidentiality and availability are not directly affected.

Vulnerable installations are those running Purchase and Expense Manager plugin versions up to and including 1.1.2 on any WordPress site.

The CVSS score of 4.3 categorizes the issue as moderate, and with an EPSS score of fewer than 1 % the probability of exploitation is low, though the vulnerability is listed in no CISA KEV catalog. The likely attack vector remains a CSRF attack that requires a user‑agent trick or social engineering to force an administrator to click a malicious link. Successful exploitation leads to arbitrary deletion of purchase records on the affected site.